Pass the Checkpoint CCME 156-836 Questions and answers with ExamsMirror

HyperSync is a feature of Maestro that enables stateful synchronization of connections and resources across different sites in a Dual Site environment. HyperSync works by creating two backup connections for each active connection: one on the same site as the active connection, and another on the remote site. This ensures that the connection can be seamlessly resumed in case of afailover event, either within the same site or across the sites. HyperSync uses the Site-Sync port and VLANs to transmit the synchronization packets between the Security Group Members and the Maestro Orchestrators.

References =

•Maestro Dual Site configuration with a direct connection through L2 switches

•Maestro Frequently Asked Questions (FAQ)

•CHECK POINT MAESTRO EXPERT

In a Check Point Maestro environment, a splitter is used to divide a single high-speed port (e.g., QSFP or QSFP28) into multiple lower-speed ports (e.g., SFP or SFP+). However, a splitter cannot be used to connect a single port on an Orchestrator to the same Appliance, as this would not align with the purpose of a splitter, which is to expand connectivity to multiple devices or ports, not to loop back to a single device.

Exact Extract:

“A splitter is used to divide a single high-speed port on the Orchestrator (e.g., QSFP or QSFP28) into multiple lower-speed ports (e.g., SFP or SFP+). Splitters are typically used to connect a single Orchestrator port to multiple ports on an external switch or to multiple Appliances. However, a splitter cannot be used to connect a single Orchestrator port to the same Appliance, as this does not align with the splitter’s purpose of expanding connectivity.”

—Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 3: Dual Orchestrator Environment, Lesson 3.2: Connectivity Options, page 3-10

—Check Point R81 Maestro Administration Guide, Chapter 3: Working with Security Group Modules, Section: Connectivity, page 3-10

Explanation of Options:

A. To connect a single port on an Orchestrator to the same Appliance: Correct, as a splitter is not designed for this purpose and cannot be used to connect an Orchestrator port to a single Appliance.

B. To connect a single port on an Orchestrator to multiple ports on an external switch: Incorrect, as this is a valid use case for a splitter.

C. To connect a single port on an Appliance to multiple ports on the Orchestrator: Incorrect, as splitters can be used in configurations where an Appliance connects to multipleOrchestrator ports.

D. To connect a single port on an Orchestrator to multiple Appliances: Incorrect, as this is another valid use case for a splitter.

A Security Group (SG) requires at least one management port and one uplink port to function properly. The management port is used to connect the SG to the Maestro Hyperscale Orchestrator (MHO) and the customer’s management infrastructure, such as SmartConsole or SmartDomain Manager. The uplink port is used to connect the SG to the customer’s network infrastructure, such as switches, routers, or firewalls. The uplink port is also used to send and receive traffic from the customer’s network to the SG.

The /var/log/messages file is a general system log file that contains information about various system events, such as booting, shutdown, cron jobs, kernel messages, and other system services. Logs without a dedicated log file can be found in this file, as well as some Maestro Gaia Clish commands that are not saved in the /var/log/command_logger.log file.

References

•Maestro Audit Logs - Where are they? - Check Point CheckMates1

•sk172923: The /var/log/messages file does not save Maestro Gaia Clish commands2

•Maestro Expert (CCME) Course - Check Point Software, page 33

The correct interfaces to connect to Orchestrator 1 for downlinks’ intra-orchestrator redundancy when using two Orchestrators are Port 1 in Slot 1 and Port 1 in Slot 2. This is because each slot represents a different NIC, and each port represents a different physical link. By connecting two ports from different slots, the appliance can have redundant connections to the same orchestrator, and avoid a single point of failure in case of a NIC or link failure.

References

•Check Point 156-835 Certification Flashcards | Quizlet1

•Maestro Expert (CCME) Course - Check Point Software, page 182

•Maestro Technical Training, Module 2: Maestro Security Groups and the Single Management Object, slide 163

References =

•Check Point Maestro R81.X Administration Guide, page 64, section “Correction Layer” 1

•Check Point Maestro R81.X Getting Started Guide, page 26, section “Correction Layer” 2

•Check Point Maestro Under the Hood presentation by Lari Luoma, slide 23

•Check Point Maestro Frequently Asked Questions (FAQ), question 9

1: https://www.manualslib.com/manual/2031661/Check-Point-Maestro-R80-20sp.html 2: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Maestro_GettingStarted/html_frameset.htm : https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/maestro/1191/1/Check%20Mates%20Maestro%20under%20the%20hood%202022.pptx :https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails= &solutionid=sk147853&partition=Basic&product=Maestro

The asg calc command is a tool to show which SGM is selected to receive traffic based on the distribution mode and the packet parameters. It takes the port number, the source IP, the destination IP, and optionally the source port and the destination port as arguments and returns the SGM ID and the hash value. For example, asg calc 1 10.0.0.1 20.0.0.2 1234 80 will show which SGM will receive the traffic from 10.0.0.1:1234 to 20.0.0.2:80 on port 1.

References

•Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 4: Using the Command Line Interface and WebUI, Lesson 4.1: asg calc, page 4-5

•Check Point R81 Maestro Administration Guide, Chapter 4: Using the Command Line Interface and WebUI, Section: asg calc, page 4-5

•asg calc - Check Point Software

The Maestro Hyperscale Orchestrator MHO-140 supports a variety of transceivers to provide high-speed and high-density connectivity. Specifically, it supports SFP, SFP+, QSFP, and QSFP28 transceivers, which cater to different port speeds and connectivity requirements in the Maestro environment.

Exact Extract:

“The Orchestrator MHO-140 supports SFP, SFP+, QSFP, and QSFP28 transceivers on its ports. SFP stands for Small Form-factor Pluggable, SFP+ supports up to 10 Gbps, QSFP (Quad Small Form-factor Pluggable) supports up to 40 Gbps, and QSFP28 supports up to 100 Gbps per port.”

—Check Point Certified Maestro Expert (CCME) R81.X Courseware, Module 1: Introduction to Check Point Maestro, Lesson 1.2: Maestro Licensing and Hardware, page 1-8

—Check Point R81 Maestro Administration Guide, Chapter 1: Introduction to Check Point Maestro, Section: Maestro Licensing, page 1-6

—Check Point Quantum Maestro Orchestrator Datasheet, page 3

Explanation of Options:

A. SFP, QSFP, QSFP28: Incorrect, as it omits SFP+, which is supported by the MHO-140.

B. SFP+, SFP28, QSFP: Incorrect, as SFP28 is not explicitly listed as supported on the MHO-140, and SFP is missing.

C. SFP, SFP+, SFP28: Incorrect, as SFP28 is not supported, and QSFP and QSFP28 are omitted.

D. SFP, SFP+, QSFP, QSFP28: Correct, as this option includes all transceivers supported by the MHO-140, as per the official documentation.